package org.chipu.jnids.alert;

import java.net.InetAddress;
import java.net.UnknownHostException;
import java.util.Date;
import org.chipu.shared.util.singletons.NetworkUtils;

public final class SnortEvent implements AlertEvent {
	public final Date date;
	public final InetAddress origIp, destIp;
	public final int origPort, destPort;
	public final short protocol;
	public final String alt_protocol;
	public final byte priority;
	public final String sensor, description;
	/**
	 * It is the unique ID number for a Snort event. The format is like "[1:439:1]"
	 */
	public final String sid;
	/**
	 * It is the component within Snort that generated the alert.<br>
	 * GID=1 is the primary detection engine<br>
	 * All alerts produced by the same detection engine should have the same format<br>
	 * GIDs>100 are typically produced by the preprocessors (although GID 116 was used for the Snort decoder, which is
	 * probably not what should have been used in retrospect).<br>
	 * For reference, the different GID numbers and event numbers outside the primary detection engine are all laid out
	 * in the generators.h file in the src directory of the snort tarball.
	 */
	public final short generatorid;
	public final String classification;

	public SnortEvent(Date d, String sensor, String sid, String description, String classification, byte priority,
		String protocol, String origIp, int origPort, String destIp, int destPort) throws UnknownHostException {
		date = d;
		this.sensor = sensor;
		this.sid = sid;
		generatorid = Short.parseShort(sid.substring(1).split(":")[0]);
		this.description = description;
		this.classification = classification;
		this.priority = priority;
		// protocol=TCP|PROTO:255
		this.protocol = protocol.startsWith("PROTO:")? Short.parseShort(protocol.substring(6)): NetworkUtils
			.getProtocolCode(protocol);
		alt_protocol = protocol;
		// if(this.protocol==-1)logger
		this.origIp = InetAddress.getByName(origIp);
		this.origPort = origPort;
		this.destIp = InetAddress.getByName(destIp);
		this.destPort = destPort;
	}

	@Override
	public String toString() {
		return SnortParser.getEngine(generatorid).toString(this);
	}
}